• Eric Dumazet's avatar
    bonding: fix data-races around agg_select_timer · 9ceaf6f7
    Eric Dumazet authored
    syzbot reported that two threads might write over agg_select_timer
    at the same time. Make agg_select_timer atomic to fix the races.
    
    BUG: KCSAN: data-race in bond_3ad_initiate_agg_selection / bond_3ad_state_machine_handler
    
    read to 0xffff8881242aea90 of 4 bytes by task 1846 on cpu 1:
     bond_3ad_state_machine_handler+0x99/0x2810 drivers/net/bonding/bond_3ad.c:2317
     process_one_work+0x3f6/0x960 kernel/workqueue.c:2307
     worker_thread+0x616/0xa70 kernel/workqueue.c:2454
     kthread+0x1bf/0x1e0 kernel/kthread.c:377
     ret_from_fork+0x1f/0x30
    
    write to 0xffff8881242aea90 of 4 bytes by task 25910 on cpu 0:
     bond_3ad_initiate_agg_selection+0x18/0x30 drivers/net/bonding/bond_3ad.c:1998
     bond_open+0x658/0x6f0 drivers/net/bonding/bond_main.c:3967
     __dev_open+0x274/0x3a0 net/core/dev.c:1407
     dev_open+0x54/0x190 net/core/dev.c:1443
     bond_enslave+0xcef/0x3000 drivers/net/bonding/bond_main.c:1937
     do_set_master net/core/rtnetlink.c:2532 [inline]
     do_setlink+0x94f/0x2500 net/core/rtnetlink.c:2736
     __rtnl_newlink net/core/rtnetlink.c:3414 [inline]
     rtnl_newlink+0xfeb/0x13e0 net/core/rtnetlink.c:3529
     rtnetlink_rcv_msg+0x745/0x7e0 net/core/rtnetlink.c:5594
     netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494
     rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612
     netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
     netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343
     netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919
     sock_sendmsg_nosec net/socket.c:705 [inline]
     sock_sendmsg net/socket.c:725 [inline]
     ____sys_sendmsg+0x39a/0x510 net/socket.c:2413
     ___sys_sendmsg net/socket.c:2467 [inline]
     __sys_sendmsg+0x195/0x230 net/socket.c:2496
     __do_sys_sendmsg net/socket.c:2505 [inline]
     __se_sys_sendmsg net/socket.c:2503 [inline]
     __x64_sys_sendmsg+0x42/0x50 net/socket.c:2503
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    value changed: 0x00000050 -> 0x0000004f
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 0 PID: 25910 Comm: syz-executor.1 Tainted: G        W         5.17.0-rc4-syzkaller-dirty #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Cc: Jay Vosburgh <j.vosburgh@gmail.com>
    Cc: Veaceslav Falico <vfalico@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    9ceaf6f7
bond_3ad.c 85.6 KB